Management UI

app/Http/Controllers/OwnerInvitationController.php

@@ -0,0 +1,60 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Models\StaffInvitation;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\View\View;
+
+class OwnerInvitationController extends Controller
+{
+    public function show(string $token): View|RedirectResponse
+    {
+        $invitation = $this->findValidInvitation($token);
+
+        return view('auth.owner-invite', [
+            'invitation' => $invitation,
+            'business' => $invitation->business,
+        ]);
+    }
+
+    public function accept(Request $request, string $token): RedirectResponse
+    {
+        $data = $request->validate([
+            'password' => ['required', 'string', 'min:8', 'confirmed'],
+        ]);
+
+        $invitation = $this->findValidInvitation($token);
+
+        DB::transaction(function () use ($invitation, $data): void {
+            $invitation->staff->user->update([
+                'passwordHash' => Hash::make($data['password']),
+                'emailVerified' => now(),
+            ]);
+            $invitation->update(['acceptedAt' => now()]);
+        });
+
+        Auth::login($invitation->staff->user->fresh());
+        $request->session()->regenerate();
+
+        $hostname = $invitation->business->primaryDomain?->hostname;
+        $destination = $hostname
+            ? request()->getScheme().'://'.$hostname.'/owner'
+            : route('owner.dashboard');
+
+        return redirect()->to($destination)->with('status', 'Your owner workspace is ready.');
+    }
+
+    private function findValidInvitation(string $token): StaffInvitation
+    {
+        $invitation = StaffInvitation::query()->with(['business.primaryDomain', 'staff.user'])->where('token', $token)->firstOrFail();
+
+        abort_if($invitation->acceptedAt || $invitation->expiresAt->isPast(), 410, 'This invitation has expired or has already been used.');
+
+        return $invitation;
+    }
+}